/*
 * pretest.h
 *
 *  Created on: 2011-2-22
 *      Author: root
 */

#ifndef PRETEST_H_
#define PRETEST_H_

#include <ctype.h>
#include <string.h>
#include <stdlib.h>
#include <stdio.h>
#include <signal.h>
#include <unistd.h>
#include <time.h>

#include <netinet/in.h>
#include <netinet/ip.h>
#include <netinet/tcp.h>
#include <netinet/udp.h>
#include <netinet/ip_icmp.h>
#include <netinet/if_ether.h>
#include <arpa/inet.h>

#include <sys/types.h>
#include <sys/socket.h>
#include <sys/ioctl.h>
#include <linux/sockios.h>
#include <linux/if.h>

unsigned char buff[65536];
struct sbuff *sbuffptr;
struct attack_stats attack;
#define MAX_URL_LEN 200
#define MAX_SYN 5
#define MAX_ECHO 5
#define MAX_ECHOREPLY 5
#define MAXBUFFSIZE 65536

struct sbuff
{
   union{
   struct tcphdr *tcph;
   struct udphdr *udph;
   struct icmphdr *icmph;
   struct igmphdr *igmph;
   } h;

   union{
	struct arphdr *arph;
   struct iphdr *iph;
   } nh;

   unsigned char *data;
} ;

struct attack_stats {
    unsigned int synflood;
    struct sbuff synsbuff;
    unsigned int pingflood;
    struct sbuff pingsbuff;
    unsigned int smurf;
    struct sbuff smurfsbuff;
};

typedef struct {
        unsigned char ip_add[4];
        unsigned char mac_add[6];
        }ip_mac;                              //IP地址-MAC地址
ip_mac src_ipmac,des_ipmac;
ip_mac fix_ipmac[40];                        //存储固定IP-MAC地址的数组
int ipmaclength;                             //网段中存在多少对ip-mac
int fix_num;
char *ptr;
struct Q_NETBIOSNS	//Netbios-ns 询问包的结构
{
	unsigned short int tid;		//unsigned short int 占2字节
	unsigned short int flags;
   	unsigned short int questions;	//=1,表示询问
   	unsigned short int answerRRS;	//=1,表示回答
	unsigned short int authorityRRS;
	unsigned short int additionalRRS;
	unsigned char name[34];	//Queries部分
   	unsigned short int type;
   	unsigned short int classe;
};


extern void process_arp(const unsigned char buff[]);
extern void process_tcp(const struct sbuff *sbuffptr);
extern void process_udp(const struct sbuff *sbuffptr);
extern void process_icmp(const struct sbuff *sbuffptr);
extern void process_igmp(const struct sbuff *sbuffptr);
extern void stats();

extern int findport(__u16 port);
extern void process_cfg();

extern void init_arp();
extern unsigned   long   Invert_IP(unsigned   long   NormalIp);//把IP转换成能直接递增和递减的地址
extern int scan_mac(unsigned long FirstIP, int DELta);
extern int check_arp(const unsigned char buff[]);
extern int compare(ip_mac compare_ipmac,int lengh);

extern void check_dos_land(const struct sbuff *sbuffptr);
//*** dos_land 一种源IP地址是自身IP地址的攻击 ***//
extern void check_dos_winnuke(const struct sbuff *sbuffptr);
//*** dos_nuke 针对139端口的古老攻击 ***//
extern void check_probe_cgi(const struct sbuff *sbuffptr);
//*** 80号端口和HTML有关的 ***//
extern void check_scan_tcp(const struct sbuff *sbuffptr);
//*** tcp端口扫描系列 ***//
extern void check_dos_longurl(const struct sbuff *sbuffptr);
//*** 长url攻击，主要是进行缓存溢出 ***//
extern void check_dos_pingofdeath(const struct sbuff *sbuffptr);
//*** 死PING ***//
extern void do_log(char *msg,const struct sbuff *sb);
#endif /* PRETEST_H_ */
